Chainguard Registry vs Harbor

Chainguard Registry provides Chainguard Containers: minimal container images rebuilt from source daily. Its directory lists 3,115 projects and 735,898 images. Chainguard says images are continuously built in SLSA L3 hardened infrastructure with CVE patching, and lists Sigstore-signed artifacts with build-time SBOMs and digital attestations. The free offer allows up to five images per organization; the FAQ describes a freely available set of about 50 images, limited to:latest tags and without a CVE remediation SLA. Catalog plans include upstream-supported major and minor tags, contractual remediation timelines of seven days for critical vulnerabilities and 14 days for other listed severity levels, and requests for new images. Catalog features also include automated Custom Assembly tooling, a private APK repository with more than 10,000 packages, and STIG-hardened and FIPS-validated images. Images can be pulled from Chainguard or mirrored to listed artifact managers. Chainguard lists compatibility with multiple scanners. Free Images costs nothing; Catalog is priced on request. The product runs on Linux, self-hosted, and web environments.

Harbor is an open-source registry for managing artifacts across cloud-native platforms such as Kubernetes and Docker. It offers a web UI and extensible API, and can be installed on Kubernetes or a system with Docker support. Security features include policies, role-based access control, vulnerability scanning, and image signing and validation. Image scanning uses Trivy when enabled during installation, and Harbor can connect to additional scanners. It replicates images and charts to or from other registries in pull or push mode; listed adapters include Docker Hub, Amazon ECR, Google Container Registry, Azure Container Registry, and GitLab Registry. Authentication options are database, LDAP/Active Directory, and OIDC, though choosing database authentication and adding local users prevents a later switch to another mode. Project storage quotas are unlimited by default but can be set globally or per project. Robot account secrets are not stored by Harbor, so they must be saved when created; robot accounts cannot log into the user interface. Harbor is a CNCF Graduated project. HTTPS is recommended for production use.